Reduce our NEW_TOKEN send rate.

Reduce our NEW_TOKEN send rate.

Currently, we send a NEW_TOKEN frame on every new validated connection,
but thats not necessecary.  Since NEW_TOKEN tokens have a lifetime of 1
hour currently, we really only need to send a NEW_TOKEN if:
1) We validated a RETRY token
or
2) We validated a NEW_TOKEN for which the lifetime is nearing its limit

So lets do that.  When we validate a token, only generate a NEW_TOKEN if
the current token is a RETRY token, or if its a NEW_TOKEN, and there is
less than 10% of the tokens lifetime remaining.

This lets clients use NEW_TOKENS repeatedly (as per the RFC), and saves
us some network bandwith.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26517)